CVE-2016-0733
CriticalSummary
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, allowing remote attackers to bypass authentication by leveraging knowledge of a valid username.
Risk Assessment
The organization may be exposed to unauthorized access to the system, potentially leading to data leaks or unauthorized configuration changes.
Recommendation
It is recommended to upgrade Apache Ranger to version 0.5.1 or later to secure the Admin UI against this type of attack.
Other vulnerabilities in Apache Ranger
See all- CVE-2016-2174High
An SQL injection vulnerability in the policy admin tool in Apache Ranger before version 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter.
- CVE-2016-0735High
Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.
- CVE-2015-0266High
The Policy Admin Tool in Apache Ranger before version 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs.
- CVE-2026-55799Critical
Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.
- CVE-2026-44416Critical
Remote Code Execution via Arbitrary Class Instantiation in the plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
- CVE-2026-42537Critical
Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
- CVE-2026-40920Critical
Privilege Escalation via URL Parameter in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0.
- CVE-2026-32227Critical
SQL Injection vulnerability in Apache Ranger. Users are recommended to upgrade to version 2.9.0, which fixes the issue.
- CVE-2026-28672Critical
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger, affecting versions from 0.6 through 2.8.
- CVE-2017-7676Critical
Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character, which can result in unintended behavior.
Original NVD description (English source)
The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.